Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

91–100 of 1001 posts

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#91

Post by Meneth »

This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person.

The general solution is to do what Debian does.

Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use.

Keep a testing/unstable distro where new packages and new versions can be added, but even then added only by the distro maintainer, NOT by the package developers. This is where the audits happen.

NPM, Python, Rust, Go, Ruby all suffer from this problem, because they have centralized and open package repositories.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#92

Post by staminade »

hsbauauvhabzb wrote: post #62
tarruda wrote: post #57

Earlier quoted context omitted.

AFAICT, the only thing this attack relies on, is the lack of scrutiny by developers when adding new dependencies. Unless this lack of scrutiny is exclusive to JavaScript ecosystem, then this attack could just as well have happened in Rust or Golang.

JavaScript does have some pretty insane dependency trees. Most other languages don’t have anywhere near that level of nestedness.

Don't they?

I just went to crates.io and picked a random newly updated crate, which happened to be pixelfix, which fixes transparent pixels in pngs.

It has six dependencies and hundreds of transient dependencies, may of which appear to be small and highly specific a la left-pad.

https://crates.io/crates/pixelfix/0.1.1/dependencies

Maybe this package isn't representative, but it feels pretty identical to the JS ecosystem.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#93

Post by diggan »

Xelbair wrote: post #76
diggan wrote: post #37

Earlier quoted context omitted.

Off-topic, but I love how different programmers think about things, and how nothing really is "correct" or "incorrect". Started thinking about it because for me it's the opposite, JS is an OK and at least usable language, as long as you avoid TS and all that comes with it. Still, even I who'd call myself a JavaScript developer also try to avoid desktop applications made with just JS :)

JS's issue is that it allows you to run an objectively wrong code without throwing explicit error to the user, it just fails silently or does something magical. Seems innocent, until you realize what we use JS for, other than silly websites or ERP dashboards. It is full of gotchas that serves 0 purpose nowadays. Also remember that it is basically a Lisp wearing Java skin on top, originally designed in less than 2 wee…

> JS's issue is that it allows you to run an objectively wrong code without throwing explicit error to the user, it just fails silently or does something magical. Seems innocent, until you realize what we use JS for, other than silly websites or ERP dashboards.

What some people see as a fault, others see as a feature :) For me, that's there to prevent entire websites from breaking because some small widget in the bottom right corner breaks, for example. Rather than stopping the entire runtime, it just surfaces that error in the developer tools, but lets the rest to continue working.

Then of course entire web apps crash because one tiny error somewhere (remember seeing a blank page with just some short error text in black in the middle? Those), but that doesn't mean that's the best way of doing things.

> Also remember that it is basically a Lisp wearing Java skin on top

I guess that's why I like it better than TS, that tries to move it away from that. I mainly do Clojure development day-to-day, and static types hardly ever gives me more "safety" than other approaches do. But again, what I do isn't more "correct" than what anyone else does, it's largely based on "It's better for me to program this way".

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#95

Post by tormeh »

diggan wrote: post #24
madeofpalk wrote: post #13

My main takeaway from all of these is to stop using tokens, and rely on mechanisms like OIDC to reduce the blast radius of a compromise. How many tokens do you have lying around in your home directory in plain text, able to be read by anything on your computer running as your user?

> How many tokens do you have lying around in your home directory in plain text, able to be read by anything on your computer running as your user? Zero? How many developers have plain-text tokens lying around on disk? Avoiding that been hammered into me from every developer more senior than me since I got involved with professional software development.

A good habit, but encryption won't save you in all cases because anything you run has write access to .bashrc.

Frankly, our desktop OSes are not fit for purpose anymore. It's nuts that everything I run can instantly own my entire user account.

It's the old https://xkcd.com/1200/ . That's from 2013 and what little (Flatpak, etc.) has changed has only changed for end users - not developers.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#97

Post by mewpmewp2 »

diggan wrote: post #48
mewpmewp2 wrote: post #40

Earlier quoted context omitted.

Which programming languages/frameworks do you use? Do you use 1Password to load secrets to env where you run whatever thing you are working on? Or does the app load them during boot?

A bunch, ranging from JS to Clojure and everything in-between, depends on the project. The approach also depends on the project. There is a bunch of different approaches and I don't think there is one approach that would work for every project, and sometimes I requires some wrangling but takes 5-10 minutes tops. Some basic information about how you could make it work with 1Password: https://developer.1password.com/do…

How long have you been using that method? I didn't feel it's been very popular so far, although it makes a lot of sense. I've always seen people using gitignored .env files/config dirs in projects with many hardcoded credentials.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#98

Post by diggan »

pjc50 wrote: post #53
diggan wrote: post #24

Earlier quoted context omitted.

> How many tokens do you have lying around in your home directory in plain text, able to be read by anything on your computer running as your user? Zero? How many developers have plain-text tokens lying around on disk? Avoiding that been hammered into me from every developer more senior than me since I got involved with professional software development.

Isn't this quite hard to achieve on local systems, where you don't have a CI vault automation to help?

I don't think so? I don't even know what a "CI vault automation" is, I store my credentials and secrets in 1Password, and use the CLI to get the secrets for the moments they're needed, I do all my development locally and things seem fine.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#99

Post by komali2 »

epolanski wrote: post #47
jbd0 wrote: post #15

I knew npm was a train wreck when I first used it years ago and it pulled in literally hundreds of dependencies for a simple app. I avoid anything that uses it like the plague.

"I knew you weren't a great engineer the moment you started pulling dependencies for a simple app" You realize my point right? People are taught to not reinvent the wheel at work (mostly for good reasons) so that's what they do, me and you included. You ain't gonna be bothered to write html and manual manipulation, the people that will give you libraries to do so won't be bothered reimplementing parsers and file watc…

Pause, you could write an HTML to markdown library in half a day? Like, 4 hours? Or 12? Either way damn

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#100

Post by epolanski »

komali2 wrote: post #99
epolanski wrote: post #47

Earlier quoted context omitted.

"I knew you weren't a great engineer the moment you started pulling dependencies for a simple app" You realize my point right? People are taught to not reinvent the wheel at work (mostly for good reasons) so that's what they do, me and you included. You ain't gonna be bothered to write html and manual manipulation, the people that will give you libraries to do so won't be bothered reimplementing parsers and file watc…

Pause, you could write an HTML to markdown library in half a day? Like, 4 hours? Or 12? Either way damn

One that gets me 90% there would take me few hours, one that gets me 99% there few months, which is why eventually people would rather pull a dependency.
Post reply on HN